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Forum Review Procedures 



Development team members review all products iteratively throughout the development 
process. Documents prepared, reviewed, and approved by development team members 
are posted to the Forum website prior to publication so that other interested individuals 
or organizations can provide feedback. After development team members oversee the inte- 
gration of public review comments and review the document a final time, all publications 
are subject to examination by members of the Forum standing committee sponsoring the 
project. Finally, the entire Forum (approximately 120 members) must review and vote to 
formally approve the document prior to final publication. 



Publications of the National Forum on Education Statistics do not undergo the formal 
review required tor products ot the National Center tor Education Statistics. The 
information and opinions published here ore the product ot the National Forum on 
Education Statistics and do not necessarily represent the policies or views ot the U.S. 
Department ot Education or the Notional Center tor Education Statistics. 
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Introduction 



As an employee of a school or other education institution, you may sometimes access 
individual student records while performing your official duties. Under the Family 
Educational Rights and Privacy Act (FERPA), you are legally and ethically obliged 
to safeguard the confidentiality of any information they contain. This guide provides 
a general overview of the legal and related issues you may encounter while carrying 
out your duties. 

The Forum Guide to the Privacy of Student Information: A Resource for Schools was written 
to help school and local education agency staff better understand and apply FERPA, a 
federal law that protects privacy interests of parents and students in student education 
records. The Forum has developed full reports on student (and staff) privacy guidance, 
but a shorter document was needed to provide a quick overview and links to other 
resources when more information is needed. This guide defines terms such as “education 
records” and “directory information”; and offers guidance for developing appropriate privacy 
policies and information disclosure procedures related to military recruiting, parental 
rights and annual notification, videotaping, online information, media releases, surveillance 
cameras, and confidentiality concerns related specifically to health-related information. 
Additional references to related resources from both the federal government and private 
organizations can be found in the online document, “FERPA Facts for School Staff,” 
which is available at http://nces.ed.gov/forum/ferpa_links.asp. 

For a more in-depth review of privacy laws and professional practices that apply to 
information collected for, and maintained in, student records, see the Forum Guide 
to Protecting the Privacy of Student Information: State and Local Education Agencies 
(NCES 2004). 



The school district 
is responsibie for 
ensuring that aii 
parents and eiigibie 
students are afforded 
aii the rights provided 
them by FERPA. 



FERPA-reiated vioiations may have serious repercussions. A schooi district found fo have vioiafed FERPA 
wiii be required fo impiemenf a pian of acfion fo ensure compiiance, and schoois fhaf refuse fo compiy risk 
iosing federai educafion doiiars. Therefore, if is essenfiai fo frain schooi sfaff in FERPA requiremenfs, especiaiiy 
since fhe Famiiy Poiicy Compiiance Office (FPCO) investigates entire schooi districts even when compiaints are 
fiied against individuai schooi officiais. 
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FERPA and Its Protection 
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The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects 
the privacy interests of students. It affords parents the right to access and amend their 
children’s education records, and gives them some control over the disclosure of the 
information in these records. FERPA generally prevents an education agency or institution 
from sharing student records, or personally identifiable information in these records, 
without the written consent of a parent. A “parent” is defined as a natural or adoptive 
parent, a legal guardian, or an individual acting as a parent in the absence of the parent 
or guardian. When students reach the age of 18, or attend a postsecondary institution at 
any age, they are considered “eligible students” and all of the rights afforded by FERPA 
transfer from the parents to the students. (34 CFR § 99.3) 



Although student files are protected under the law, FERPA does allow the disclosure of 
student data without parental consent under certain, specified conditions. For example, 
schools may reveal information from student records to school officials with a legitimate 
educational interest in the information. 



As employees of a school and education institution, you may have access to individual 
student records in performing your official duties. You are legally and ethically obliged 
to safeguard their confidentiality. This guide provides a general overview of FERPA and 
related issues you may encounter while you carry out your job duties. 



FERPA applies 
to any education 
agency or institution 
that receives funds 
under a program 
administered by the 
U. S. Department 
of Education. 



Education Records 

The term “education records” is defined as all records, files, documents and other 
materials containing information directly related to a student; and maintained 
by the education agency or institution, or by a person acting for such agency or 
institution (34 CFR § 99.3). This includes all records regardless of medium, including, 
but not limited to, handwriting, videotape or audiotape, electronic or computer files, 
film, print, microfilm, and microfiche. 

In addition, for students who attend a public school district, all records pertaining to 
services provided under the Individuals with Disabilities Education Act (IDEA) are 
considered “education records” under FERPA. As such, they are subject to the confi- 
dentiality provisions of both Acts. 

For PreK-I2 students, health records maintained by an education agency or institution 
subject to FERPA, including immunization records and school nurse records, generally 
would be also considered “education records” and subject to FERPA because they are: 

• directly related to the student; 

• maintained by an education agency or institution, or a party acting for the agency 
or institution; and 

• not excluded from the definition of education records as treatment or sole-possession 
records, or on some other basis. (See Flealth Records: FERPA and FIIPAA.) 

Personal notes made by teachers or other staff, on the other hand, are not considered 
education records if they are: 
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• kept in the sole possession of the maker; 

• not accessible or revealed to any other person except a temporary substitute, and 

• used only as a memory aid. 

Records created and maintained by a law enforcement unit for law enforcement purposes 
are also excluded. 



More on FERPA con be found at: http://www.ed,gov/policy/gen/guicl/fpco/inclex,hfml 




Dircctorg Information 



The term “directory information” is used for the portion of the education record that, 
if disclosed, would not generally be considered harmful or an invasion of privacy (34 
CFR § 99.3). This may include the student’s name, address, telephone number, date 
and place of birth, honors and awards, and dates of attendance. 

Under FERPA, school systems have flexibility in deciding what information will be 
considered directory information. A list of the types of data that may be designated 
and disclosed as directory information is listed under the definition of “directory 
information” in the Code of Federal Regulations (34 CFR § 99.3). While school 
systems designate varying types of information as directory information, most include 
a student’s name, family members’ names, home address, and school activities. The 
height and weight of athletes may also be included. 

School systems should give careful consideration to designating data as “directory 
information” because once this designation is given, school officials may distribute the 
information to anyone who requests it — in or outside the school. 



If a school system 
discloses directory 
information, it must 
give "public notice" of 
this policy and explain 
what is included in such 
information. FERPA 
does not define "public 
notice," and the 
means of notification 
is left up to the school. 



School systems that disclose directory information must give “public notice” of this 
policy and explain what is included in such information. The notice must also indicate 
that parents may refuse to allow the school to designate any, or all, of their child’s record 
as directory information. Several ways public notice can be given include: a notice 
in the registration package sent home to parents, a notice in the local newspaper, a 
notice in the school handbook distributed each year, or a posting on the school 
system’s website. FERPA requires the notice to specify how much time parents have 
to tell the school or school system what, if any, directory information they do not 
wish released. 



Annual Notification and Rights of Parents 

FERPA regulations require that local education agencies give annual notification to parents 
and eligible students of their rights under FERPA (34 CFR § 99.7). The law does not 
requires agencies to notify parents and eligible students individually, but agencies must 
provide notification where they are likely to see it. In addition, education institutions 
must make provisions to effectively inform individuals with a disability or whose primary 
language is not English. 
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The annual notification process must ensure that parents understand that they have the 
right to: 

• inspect and review their child’s record; 

• seek to amend the record if they believe it to be inaccurate; 

• consent (or not) to disclosures of personally identifiable information; and 

• file a complaint with the U.S. Department of Education concerning the district’s 
failures to comply with FERPA. 



Either parent has the right to review an education record unless there is evidence of a 
court order or state law revoking or restricting these rights. Parents may access the edu- 
cation records of eligible students if they claim the student as a dependent for income 
tax purposes. However, agencies may require verification of the requester’s relationship 
with the child before providing access to records. 



The right of parents to access information is limited to their own child or children. If 
the education record includes information about other students, that information must 
be removed prior to disclosure so that parents do not have access to any other child’s 
records. (34 CFR § 99.12) 



When parents (or eligible students) request to review their records, the education insti- 
tution must respond within 45 days, even if these records are kept by an outside party 
acting for the school. During these 45 days, the education institution cannot destroy 
any of the requested records. 



For more in-depth information on directory information, disclosure of 
student information, and annual notification to parents, see the Forum Guide 
to Protecting the Privacy of Student Information: State and Local Education Agencies 
(Notional Forum on Education Statistics, 2004). 



Disclosure of Student Information 

Generally, schools must have written parent (or eligible student) permission to release 
any information from a student’s education records. However, in addition to properly 
designated “directory information,” FERPA allows disclosure, without consent, to the 
following parties or under the following conditions (except as noted, conditions are 
listed in 34 CFR § 99.31): 

A legitimate educational interest 

School officials with a “legitimate educational interest’ may access student records 
under FERPA. Generally, this refers to individuals in the school district who need to 
know information in the student’s education record in order to perform their professional 
responsibility. Interest in students that “fit” a profile or category is not a legitimate 
educational interest. The school’s criteria for appropriate “school officials” and valid 
“legitimate educational interest” must be included in the annual notification to 
parents of their FERPA rights. A sample notice of rights, including suggested 
language can be found at the Family Policy Compliance Office’s website: 
http-.llw-ww. ed.govipolicylgeniguidlfpcolferpallea-offtcials. html. 
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other schools into which a student is tronsferrinq or enrolling 

Schools that submit a records request or in which a student has enrolled are eligible to 
receive information from that student’s education records. This includes postsecondary 
institutions to which the student are applying. A parent (or eligible student) may also 
request a records transfer. 

Specified officials for audit or evaluation purposes 

This category exception refers to federal, state, and local education agencies that must col- 
lect data or student information to audit, evaluate, or enforce educational programs. State 
agencies other than those responsible for education are not included. This exception is 
commonly used by state education agencies to justify state-level student records systems. 

Appropriate parties in connection with financial aid 

Information required to determine student eligibility for financial aid, the amount of 
aid to award, and the conditions under which aid is to be granted may be disclosed 
under this category; access to information needed to enforce those terms and conditions 
is also allowed. This exception typically applies to postsecondary institutions. 




Organizations conducting certain studies for, or on behalf of, 
the school 

The purpose of the study conducted for, or on behalf of, a school has to be to: develop, 
validate, or administer predictive tests; administer student aid programs; or improve 
instruction. Even if these conditions are met, the school may only disclose information 
if: the study methodology does not permit the personal identification of parents and 
students by anyone other than the researchers and their representatives; the information 
is not used for any purpose other than to complete the study; and the information is 
destroyed when it is no longer needed for the stated purposes of the study. 



Accrediting organizations 

Disclosure of personal information is permitted to an accrediting organization if it is 
needed to carry out the accreditation. 



Judicial orders or lawfullg issued subpoenas 

Schools must release information requested by a judicial order or legal subpoena. 
However, the school must make a reasonable effort to notify the parent (or eligible student) 
in advance of compliance, unless the court or other issuing agency has ordered that the 
contents of the subpoena not be disclosed, or that the protected education records not 
be included. [34 CFR § 99.31 paragraph (a)(9)(l)] 

Health and safetg emergencies 

Disclosure to appropriate officials is valid if the information contained in the education 
record is necessary to protect the health or safety of the student or other individuals 
(34 CFR § 99.36). 



State and local authorities, within a juvenile justice sgstem, 
pursuant to specific state law 

If state law permits, schools may release information to state and local juvenile justice 
authorities after receiving written certification that the information will not be disclosed 
to any other agency, organization, or third party without the parent’s permission, except 
as allowed in state law. 
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In all of the above cases, education agencies or institutions disclosing personally identifi- 
able information from an education record must do so on the condition that the party 
receiving the information will use it only for the purpose for which it was disclosed, 
and will not disclose the information to another, third party without prior consent. 
An exception is allowed if the disclosure is made on behalf of the education agency 
or institution under the permitted disclosures in FERPA. (34 CFR § 99.33) 

Transfer of School Disciplinarg Records 

while FERPA does not require schools to transfer education records to third parties, 
it does permit their transfer to another school if a student seeks or intends to enroll in 
that school; as part of the education records, disciplinary records would therefore be 
included in the transfer. Flowever, the No Child Left Behind Act of 200 1 , reauthorizing 
the Elementary and Secondary Education Act (ESEA), requires that states provide an 
assurance to the Secretary of Education that the state “has a procedure in place to facili- 
tate the transfer of disciplinary records, with respect to a suspension or expulsion, by 
local education agencies to any private or public elementary school or secondary school 
for any student who is enrolled or seeks, intends, or is instructed to enroll, on a full- or 
part-time basis, in the school.” 



Health Records: FERPA and HIPAA 

In 1996, Congress enacted the Ideal th Insurance Portability and Accountability Act 
(IdIPAA) to ensure continued health insurance coverage to individuals who change jobs, 
and to establish standards regarding the electronic sharing of health information. For 
purposes of IdIPAA, “covered entities” include health plans, health care clearinghouses, 
and health care providers that transmit health information in electronic form in connection 
with covered transactions (45 CFR 160.103). 

Technically, schools and school systems that provide health care services to students 
may qualify as “covered entities” under IdIPAA. However, the final regulations for 
the HIPAA Privacy Rule exclude information considered “education records” under 
FERPA from HIPAA privacy requirements. This includes student health records 
and immunization records maintained by an education agency or institution, or its 
representative; as “education records” subject to FERPA, these files are not subject 
to HIPAA privacy requirements. In addition, school nurse or other health records 
maintained on students receiving services under the Individuals with Disabilities 
Education Act (IDEA) are considered “education records” and also subject to that 
Act’s confidentiality provisions. Consequently, these records are subject to FERPA 
and not the HIPAA Privacy Rule. 

Nevertheless, certain activities, when performed by a school, could be subject to other 
provisions of HIPAA that concern electronic transactions. According to the preamble 
to the December 2000 final rules, “the educational institution or agency that employs 
a school nurse is subject to our (HIPAA) regulation if the school nurse or the school 
engages in a HIPAA transaction.” HIPAA transactions are defined in the Code of 
Federal Regulations (CFR) as “the transmission of information between two parties 
to carry out financial or administrative activities related to health care,” including 
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submitting claims. However, consent must still be secured under FERPA before the 
records are disclosed. 



For more information on the intersection of FIIPAA and FERPA, see Health and 
Healthcare in Schools, "The Impact of FERPA and FIIPAA on Privacy Protections 
for Fleolth Information at School: Questions from Readers" (2003, Volume 4, 
Number 4) at http://www.healthinschools.org/ejournal/2003/privacy.htm. 



Data Requests and FERPA 

Information requests from the press, researchers, and the general public are fairly 
common in most school systems and state education agencies. In this regard, the 
FERPA statute provides that an education agency or institution may not have a policy 
of disclosing education records or personally identifiable information from education 
records, without prior consent from the parent or eligible student, unless it is considered 
directory information or falls under one of the other consent exceptions contained in the 
law [20 U.S.C. §1232(g)(b)(l)]. (For exceptions to consent guidelines, see Disclosure 
of Student Information.) Agencies should determine whether requests for data meet 
these exceptions on a case-by-case basis. 

Nothing in FERPA prohibits a school from disclosing information in aggregate, or in 
another form that is not personally identifiable. Personally identifiable information 
includes: 

• the student’s name; 

• the name of the student’s parent or other family member; 

• the address of the student or student’s family; 

• a personal identifier, such as the student’s social security number or student 
number; 

• a list of personal characteristics that would make the student’s identity easily 
traceable; or 

• other information that would make the student’s identity easily traceable. 

In circumstances that may lead to the identification of an individual, the disclosing 
education agency or institution must ensure that student-level information is not 
personally identifiable by removing the student’s name and ID number, as well as 
any “personal characteristics” and “other information that would make the student’s 
identity easily traceable.” This includes, but is not limited to, such factors as physical 
description (race, sex, appearance, etc.); date and place of birth; religion and national 
origin; participation in sports, clubs, and other activities; academic performance; 
employment; and disciplinary actions or criminal proceedings. “Other information 
that would make the student’s identity easily traceable” may also exist in the form 
of small cell sizes in aggregated or statistical information from education records. 

In cases where personal information cannot be removed, school officials must secure 
written parental consent before disclosing the data to outside organizations. The 
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"Confidentiality" 
is a person's obligation 
to not disclose or 
transmit information 
to unauthorized 
parties. 

"Privacy" 

is a uniquely personal 
right that reflects an 
individual's freedom 
from intrusion. 



required consent form should specify: 

• the records that may be disclosed; 

• the purpose of the disclosure; and 

• the identity of the party or class of parties to whom the disclosure may be made. 
[34 CFR § 99.30(b)] 

Militarg Recruiters 

The No Child Left Behind Act of 2001 (NCLB) and the National Defense Authorization 
Act for Fiscal Year 2002 both require high schools to provide military recruiters with 
access to directory-type information on secondary school students. Upon request, and 
after notifying parents, schools must release to military recruiters the name, address, and 
telephone numbers of high school juniors and seniors. (The disclosed information is used 
only for armed services recruiting and to inform high school students of scholarship 
opportunities.) 

To minimize their administrative burden, some schools notify parents of the military 
recruiters’ right to student data by utilizing the same notice they use to inform parents of 
directory information disclosure. A sample directory information notice with reference to 
disclosures to military recruiters can be found on the Family Policy Compliance Office’s 
(FPCO) website: httpiUwww. ed.govlpolicylgenlguidljpcolhottopicslht-10-09-02a. html. 

Schools that normally do not disclose directory information and, therefore, may not 
have a directory-information disclosure policy under FERPA, must nevertheless release 
to military recruiters the student information listed above unless parents (or 
eligible students) disallow disclosure. 



Confidcntialitg and Privaeg Concerns 

Until recently, the main concern regarding confidentiality and privacy of education 
records centered on individuals hacking into central computer systems or otherwise illegally 
accessing records through other security breaches. With technology increasingly used to 
ensure the availability of timely and accurate information, however, the scope of this issue 
has expanded to include portable storage devices (flash drives), handheld computers, 
electronic information transfers (e-mail), and other tools and devices used to store or 
transfer data. 

Today’s information portability makes performing many school-related tasks more conven- 
ient; however, it also increases the risk of unauthorized access to protected information. 
As school administrators, teachers, and support staff find new ways to store and access 
student records, they must still ensure the information’s confidentiality and privacy. 

For example, if an administrator misplaces a handheld computer, any personally 
identifiable information it contains becomes potentially accessible to anyone who 
finds the device. Teachers carrying grade files home on a flash drive or storing other 
personally identifiable student information on home computers create the risk of 
unauthorized access to protected education records. Likewise, education records 
transferred through electronic mail could potentially be intercepted by unauthorized 



8 Forum Guide to the Privacy ot Student Intormotion 



individuals. Since such situadons occur daily in schools across the country, local 
education agencies must take precautions to guard against the unintentional release 
or unauthorized disclosure of education records. 

Each education institution subject to FERPA should consider establishing policies, 
procedures, and best practices to address the following questions: 

• What are the current legal restrictions for disclosure and nondisclosure? 

• Does the potential risk to the confidentiality and security of education records 
outweigh the benefit of using certain electronic devices poses? 

• Does the teacher or staff member have a legitimate educational interest in the 
information that meets the exception rule for prior consent (see Disclosure of 
Student Information)? 

• Is prior consent required since the ability to carry education records off school prem- 
ises changes the physical context in which the education records were originally used? 

• What jobs or roles include responsibility for the safety and maintenance of education 
records? 

• What is the ethical and legal responsibility of staff in terms of preventing 
unauthorized use or disclosure of information? 

• What is appropriate and inappropriate use of data, and how can information be 
protected against unauthorized access? 

• What type of training will individuals who access and/or use the information require? 

• Do individuals with access to personally identifiable information take an oath of 
nondisclosure? 

Establishing policies, procedures, and best practices is not a cure-all, but it sets the 
foundation for ensuring a deliberate effort to safeguard the confidentiality and privacy 
of education records. 



Updated resources con be found on the FERPA page of the Forum website: 
hffp://nces.ed.gov/forum/ferpaJinks.asp 



Surveillance Cameras 

According to Indicators of School Crime and Safety: 2005 (U.S. Departments of Education 
and Justice, 2006), schools continue to implement a variety of tools to improve safety 
and monitor activities. In fact, the report notes that “in 1999-2000, 14 percent of 
primary schools, 20 percent of middle schools, and 39 percent of secondary schools 
used one or more security cameras to monitor the school.” 

School cameras are typically placed in areas that do not infringe on students’ right to 
privacy, such as classrooms, hallways, common areas, and building perimeters. However, 
recent reports of cameras in bathrooms have sparked a debate over the appropriate balance 
between student privacy rights and the need for school security. While FERPA does not 
specifically address this issue, school systems should have a surveillance camera policy 
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outlining the rights and responsibilities of students, teachers, administrators, and other 
school staff As a best practice, the policy should include the following: 

• a clear statement of appropriate reasons for using surveillance cameras; 

• the role and responsibilities of individuals with access to the cameras; 

• who will have access to any footage; 

• how long will any footage be kept and how will it be destroyed; and 

• a consent provision. 



For FERPA purposes, surveillance videotapes (or other media) with information about a 
specific student are considered education records if they are kept and maintained by the 
school system. If the school’s law enforcement unit controls the cameras/videos and it 
is doing the surveillance for safety reasons, the ensuing videos would be considered law 
enforcement, rather than education, records. As soon as school officials use them for 
discipline purposes, however, the tapes become education records and are subject to 
FERPA requirements. 



For more information, see "Fact sheet 29: Privacy in Education" (Privacy Rights 
Clearinghouse, 2005) at hftp://www.pnvacyrights.org. 



For more in-depth information on directory information, disclosure of student 
information, and annual notification to parents, see the Forum Guide to Protecting 
the Privacy of Student Information: State and Local Education Agencies (Notional 
Forum on Education Statistics, 2004). 



Videotapes and Online Information 

when created and kept by the school or education agency, videotapes or photographs 
directly related to a specific student are considered part of that student’s education records 
and, therefore, subject to FERPA. For instance, if the tape captured an altercation, it 
would be included in the involved students’ education record, and the school has to 
obtain consent before publishing or disclosing its contents to unauthorized individuals. 
Flowever, authorization would be needed only for the students actually involved in the 
altercation; other students in the video would be considered “set dressing” (not relevant 
to the incident) and not covered. 

Information on the Internet is treated in a similar way. Posting information is considered 
“disclosure” and must, therefore, comply with FERPA guidelines. Even without FERPA, 
school officials should consider safety concerns and exercise caution when displaying infor- 
mation (such as identifiable pictures) about students on the Internet, even if the information 
is designated as directory information. Including parents in any decisions about how much 
student information is appropriate might be a good practice, especially for younger students. 

More information on this topic can be found in TAe Appropriate and Effective Use of 
Security Technologies in US. Schools: A Guide for Schools and Law Enforcement Agencies 
(U.S. Department of Justice Office of Justice Programs 1999), which is available online 
at http:! ! WWW. ncjrs.gov/school/home.html. 
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Conclusion 

Safeguarding the confidentiality of individual student information is the responsibility 
of any and all organizations and individuals who collect, maintain, access, transfer, or 
use education records. This guide reviews federal privacy laws, defines related terms 
and concepts, summarizes organizational and individual responsibilities, and describes 
appropriate responses to privacy-related concerns that commonly arise in a school or 
district setting. 

This document is meant to serve as a resource for schools and school districts, but 
is not a substitute for the detailed direction provided in local and state privacy laws, 
regulations, and procedures. For a more in-depth review of privacy laws and professional 
practices that apply to information collected for, and maintained in, student records, 
see the Forum Guide to Protecting the Privacy of Student Information: State and Local 
Education Agencies (NCES 2004). Additional resources about FERPA and other privacy 
issues can be found in the online document, “FERPA Facts for School Staff,” available 
at http:llnces.ed.govlforumlferpa_links.asp. Schools and districts should also consult all 
local and state privacy laws, regulations, and procedures to which they are subject. 
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Appendix A. Keg Terms ond Definitions 

Source: Forum Guide to Protecting the Privacy of Student Information: State and Local Education Agencies. (National Forum 
on Education Statistics, 2004). Terms marked with an asterisk (*) indicate a consistent definition with FERPA. 

Confidentiality: a person’s obligation not to disclose or transmit information to unauthorized parties. 

Directory Information*: information contained in a student’s education record that would not generally be considered 
harmful or an invasion of privacy if disclosed. 

Disclosure: access, release, or transfer of personally identifiable information about an individual. 

Education Agency: a state or local education agency authorized to direct and control public elementary and secondary, or 
postsecondary, institutions. 

Education Institution: an institution or school that provides educational services or instruction, or both, to students. 

Education Record*: any information recorded in any way — including, but not limited to, handwriting, print, computer 
media, videotape or audiotape, electronic files, film, microfilm, and microfiche — that are maintained by education 
agencies or institutions, or individuals acting on their behalf Personal notes by teachers or other staff, kept in the sole pos- 
session of the maker, used only as memory aid, and not accessible or revealed to any other person except a temporary sub- 
stitute are not considered part of the education record. 

Eligible Student*: a student who has reached the age of 18; or has attended a postsecondary institution, regardless of age. 

Informed Consent: an individual’s agreement in the context of a written account of why personal information is requested 
and how it will be used. 

Legitimate Educational Interest: information is used within the context of official agency or school business and its use 
is consistent with the purpose for which it is maintained; access to the information is necessary for school officials to 
perform tasks related to their position. 

Parent*: a natural or adoptive parent, a legal guardian, or an individual acting as a parent in the absence of a parent or 
guardian. 

Personally Identifiable Information*: includes the student’s name; the name of the student’s parent or other family member; 
the address of the student; a personal identifier, such as the social security number or student number; a list of personal 
characteristics that would make the student’s identity easily traceable; or any other information that would make the 
student’s identity easily traceable. 

Privacy: a uniquely personal right that reflects an individual’s freedom from intrusion. 

School Official: a person employed by the agency or school in an administrative, counseling, supervisory, academic, student 
support, or research position; or a person under contract to the agency or school to perform a specified task. 

Security: the process that focuses on the confidentiality, integrity, and availability of information systems and data. 

Student*: any person who is or has been in attendance, about whom an agency or institution maintains education records or 
personally identifiable information. 
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